Intelligence Fields in ThreatStream

This section lists the intelligence fields available in ThreatStream that can be used for filtering and advanced searching.

Field Name Type Description
asn String The Autonomous System Number (ASN) for the IP associated with the observable.
classification String

Indicates the confidentiality level of an observable.

Possible values: private, public.

Notes:

  • Private also includes Trusted Circles.

  • classification is displayed as Visibility on the ThreatStream user interface.

confidence Numeric Risk score from 0 to 100, assigned by ThreatStream's predictive analytics technology to observables.
country String

Two-letter ISO country code for the IP associated with the observable. For example, US, CN, DE, and so on.
created_by String Email address of the user who submitted the import job containing the observable.
created_ts Date

UTC time stamp of when the observable was first created in ThreatStream.

Date can be specified as follows:

  • In this format: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, 2014-10-02T20:44:35.
  • As a relative time unit, in this format: -<n><unit>, where n is a whole number and unit is w, d, h, m, s (for week, days, hour, minutes, and seconds, respectively). For example, -2w denotes two weeks, starting NOW.
detail String Additional comments and context associated with the observable.
feed_group String

Name of the group or industry associated with the observable. For example, healthcare, government, financial.

Possible values: behavioral, education, financial, government, energy, healthcare, spam, hitech, retail.
feed_id Numeric

ID of the threat feed that created the observable on ThreatStream.

Note: Starting from July 14, 2023, the feed_id intelligence field is used instead of stream_id. Previously created search filters and rules containing the stream_id intelligence field are not affected.
feed_name String

Name of the threat feed that created the observable on ThreatStream.

Note: Starting from July 14, 2023, the feed_name intelligence field is used instead of stream_name. Previously created search filters and rules containing the stream_name intelligence field are not affected.
file_name String File name associated with the observable.
file_size String Size of the file associated with the observable.
file_type String File type associated with the observable.
import_session_id Numeric ID of the import session that created the observable on ThreatStream.
import_source String Original source of the observable. Values are only displayed for observables manually imported through the ThreatStream user interface by your organization. Import source for observables owned by other organizations is not visible.

ip

 String IP associated with the observable.
is_osint Boolean Whether the observable is from an open source intelligence feed.
itype String

Indicator type. For example, c2_ip, compromised_email, apt_md5, and so on.

See Indicator Types in ThreatStream for a complete list.
lat Numeric Latitude associated with the Geo location of the IP.
lon Numeric Longitude associated with the Geo location of the IP.
maltype String Information regarding a malware family, a CVE ID, or another attack or threat, associated with the observable.
modified_ts Date

UTC time stamp of when the observable was last updated in ThreatStream.

Date can be specified as follows:

  • In this format: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, modified_ts > 2014-10-02T20:44:35.
  • As a relative time unit, in this format: -<n><unit>, where n is a whole number and unit is w, d, h, m, s (for week, days, hour, minutes, and seconds, respectively). For example, -2w denotes two weeks, starting NOW. The following example shows how you will use this field in a filter: modified_ts > -14d.
org String Name of the business that owns the IP address associated with the observable. For example, Comcast, Amazon, and so on.
owner_id Numeric ID of the organization (in ThreatStream) that imported the observable.

rdns

 String Domain name (obtained through reverse domain name lookup) associated with the IP address that is associated with the observable.
registrant_email String

Email address of the person who registered the domain.

This information is obtained from WHOIS.
registrant_name String Name of the person who registered the domain.
registrant_org String

Name of the organization that registered the domain.
registrant_phone String Phone number associated with the domain registration.
registrant_address String Street address associated with the domain registration.
registration_created_ts Date Time stamp of when the domain was registered.
registration_modified_ts Date Time stamp of when the domain registration was last updated.
severity String

Criticality associated with the threat feed that supplied the observable.

Possible values: low, medium, high, very-high.
source_created

Date

UTC time stamp of when the entity was created by its original source.

Date can be specified as follows: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. T must be capitalized.
source_locations String

Source location associated with the intelligence (as defined by STIX 2.1).

Possible values include letter codes of regions, countries, and administrative areas (US States and Washington DC only).

For example: source_locations = JP, source_locations = US-AL, source_locations = europe.
source_modified

Date

UTC time stamp of when the entity was created by its original source.

Date can be specified as follows: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. T must be capitalized.
source_reported_confidence Numeric A risk score from 0 to 100, provided by the source of the observable.

status

 String

Current state of the observable in ThreatStream.

Possible values: active, inactive, falsepos.
subtype String

For hash observables—those with type=md5—subtype provides additional metadata on the type of hash associated with the observable.

Possible values: md5, sha1, sha256, sha512.
tags String

Additional comments and context associated with the observable when it was imported from its original threat feed.

Note: Because this field can contain multiple values, when specifying this field in a filter, make sure you either specify all of those values, separated by commas, in the order they appear in the ThreatStream UI, or use the startswith operator to specify the beginning of a value you are looking for. For example, to look for "phish-target,victim-hi-tech", specify detail ="phish-target,victim-hi-tech", or detail startswith phish, or detail startswith victim.
target_industry String

Target industry associated with the intelligence.

Possible target industry values are defined by the STIX 2.1 Industry Sector vocabulary.

For example, target_industry = chemical, target_industry = financial-services, target_industry = government-regional.
target_locations String

Target location associated with the intelligence (as defined by STIX 2.1).

Possible values include letter codes of regions, countries, and administrative areas (US States and Washington DC only).

For example, target_locations = AR, target_locations = US-AL, target_locations = europe.
threat_type String Summarized threat type of the observable. For example, malware, compromised, apt, c2, and so on.
tlp String

Traffic Light Protocol designation for the observable—red, amber, amber+strict, green, white or clear.

Notes: 

  • With the release of TLP v2.0., TLP:White was replaced with TLP:Clear. However, when creating advanced search queries in ThreatStream, both TLP values can be used interchangeability. For example, tlp = clear and tlp = white will match all intelligence with either TLP: Clear or TLP: White designations.

  • TLP values are case-sensitive and must be entered as specified above.
trusted_circle_id String ID of the trusted circle with which the observable is shared.
type String

Data type of the observable.

Possible values: ip, domain, url, email, md5.
value String

Specifies the value of an observable, whose type is specified by the "type" field.